Fix password reset lifetime checks

Author: hhvrc

API/Services/Account/AccountService.cs

@@ -226,9 +226,9 @@ await Task.Delay(100,
     public async Task<OneOf<Success, NotFound, SecretInvalid>> PasswordResetExists(Guid passwordResetId, string secret,
         CancellationToken cancellationToken = default)
     {
-        var validUntil = DateTime.UtcNow.Add(Duration.PasswordResetRequestLifetime);
+        var validSince = DateTime.UtcNow - Duration.PasswordResetRequestLifetime;
         var reset = await _db.UserPasswordResets.FirstOrDefaultAsync(x =>
-                x.Id == passwordResetId && x.UsedAt == null && x.CreatedAt < validUntil,
+                x.Id == passwordResetId && x.UsedAt == null && x.CreatedAt >= validSince,
             cancellationToken: cancellationToken);
 
         if (reset is null) return new NotFound();
@@ -242,12 +242,12 @@ public async Task<OneOf<Success, NotFound, SecretInvalid>> PasswordResetExists(G
     /// <inheritdoc />
     public async Task<OneOf<Success, TooManyPasswordResets, NotFound>> CreatePasswordReset(string email)
     {
-        var validUntil = DateTime.UtcNow.Add(Duration.PasswordResetRequestLifetime);
+        var validSince = DateTime.UtcNow - Duration.PasswordResetRequestLifetime;
         var lowerCaseEmail = email.ToLowerInvariant();
         var user = await _db.Users.Where(x => x.Email == lowerCaseEmail).Select(x => new
         {
             User = x,
-            PasswordResetCount = x.PasswordResets.Count(y => y.UsedAt == null && y.CreatedAt < validUntil)
+            PasswordResetCount = x.PasswordResets.Count(y => y.UsedAt == null && y.CreatedAt >= validSince)
         }).FirstOrDefaultAsync();
         if (user is null) return new NotFound();
         if (user.PasswordResetCount >= 3) return new TooManyPasswordResets();
@@ -273,10 +273,10 @@ await _emailService.PasswordReset(new Contact(user.User.Email, user.User.Name),
     public async Task<OneOf<Success, NotFound, SecretInvalid>> PasswordResetComplete(Guid passwordResetId,
         string secret, string newPassword)
     {
-        var validUntil = DateTime.UtcNow.Add(Duration.PasswordResetRequestLifetime);
+        var validSince = DateTime.UtcNow - Duration.PasswordResetRequestLifetime;
 
         var reset = await _db.UserPasswordResets.Include(x => x.User).FirstOrDefaultAsync(x =>
-            x.Id == passwordResetId && x.UsedAt == null && x.CreatedAt < validUntil);
+            x.Id == passwordResetId && x.UsedAt == null && x.CreatedAt >= validSince);
 
         if (reset is null) return new NotFound();